18-Year-Old Cisco IOS Vulnerability Actively Exploited, Added to CISA’s KEV Catalog The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2008-4128, an 18-year-old Cross-Site Request Forgery (CSRF) vulnerability in Cisco IOS 12.4, to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation. The flaw, first disclosed in 2008, affects the HTTP management interface of legacy Cisco devices, allowing attackers to execute arbitrary commands with privilege-level 15 access effectively granting full administrative control. The vulnerability can be exploited through two attack vectors: - A crafted "show privilege" command sent to the /level/15/exec/- URI - A malicious "alias exec" command injected via the /level/15/exec/-/configure/http URI Since the flaw abuses the trust placed in an authenticated administrator’s browser session, attackers can trick logged-in users into submitting forged requests without needing direct credential theft. CISA’s inclusion of CVE-2008-4128 in the KEV catalog on July 13, 2026, with a remediation deadline of July 16, 2026, highlights the ongoing risk posed by unpatched legacy infrastructure. Federal agencies and aligned organizations must act within a three-day window to mitigate exposure, per Binding Operational Directive (BOD) 26-04. The resurgence of this vulnerability underscores a persistent challenge: outdated Cisco IOS devices, often deemed "stable" or business-critical, are frequently deprioritized in patch cycles, making them prime targets for attackers scanning for exposed HTTP management interfaces. While it remains unclear whether the flaw has been used in ransomware campaigns, organizations are advised to disable the HTTP server feature if unused, restrict access via ACLs, enforce HTTPS with strong authentication, and audit configurations for signs of exploitation.